alterlab-pymatgen
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate functionality for computational materials science. The included scripts (structure_analyzer.py, structure_converter.py, phase_diagram_generator.py) use the established pymatgen library to process crystallographic data and interface with the Materials Project API. Use of the MP_API_KEY environment variable follows standard security best practices for API credential management.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external structure files, which constitutes a potential surface for indirect prompt injection if the files contain malicious instructions meant for the processing agent.
- Ingestion points: External files (CIF, POSCAR, XYZ, etc.) are read in scripts/structure_analyzer.py, scripts/structure_converter.py, and scripts/phase_diagram_generator.py using the Structure.from_file() method.
- Boundary markers: Absent. The skill does not provide specific instructions to the agent to ignore natural language patterns embedded within structure files.
- Capability inventory: The skill has file-writing capabilities via struct.to() in scripts/structure_converter.py and json.dump/yaml.dump in scripts/structure_analyzer.py. It also utilizes the Bash tool for python execution.
- Sanitization: Absent for prompt-specific content. The skill relies on the pymatgen library's internal structural validation logic for file parsing.
Audit Metadata